Back to results
US 11,440,677 B2Granted
Secured backup feature for an embedded system
AssigneesROLLS-ROYCE plc, Rolls-Royce North American Technologies Inc.
InventorsDawn Kay Andrus, Daniel John Bitz, Richard Joseph Skertic
Life of this patent
Estimating the term…
Abstract
A system is described that includes a controllable component of an engine configured to regulate fuel flow to the engine, a digital control unit configured to control the engine by at least communicating with the controllable component of the engine, and a protection component configured to disable communication between the digital control unit and the controllable component of the engine. The system further includes an analog control unit configured to control the engine by at least communicating with the controllable component of the engine in response to the protection component disabling communication between the digital control unit and the controllable component of the engine.
Claims18
A system comprising:
- a controllable component of an engine configured to regulate fuel flow to the engine;
- digital control circuitry configured to control the engine by at least communicating with the controllable component of the engine;
- backup digital control circuitry configured to control the engine, responsive to the digital control circuitry failing, by at least communicating with the controllable component of the engine;
- a protection component comprising:
- input circuitry configured to send a disable signal to an isolation component that is not susceptible to cyberattacks when inputs to the digital control circuitry and the backup digital control circuitry are inconsistent with previous inputs to the digital control circuitry and the backup digital control circuitry;
- output circuitry configured to send the disable signal to the isolation component when outputs from the digital control circuitry and the backup digital control circuitry are determined to be inconsistent with previous outputs from the digital control circuitry and the backup digital control circuitry;
- and
- protection circuitry configured to disable, responsive to receiving the disable signal via the isolation component, communication between both the digital control circuitry and the backup digital control circuitry and the controllable component of the engine;
- analog control circuitry configured to control the engine by at least communicating with the controllable component of the engine in response to the protection component disabling communication between both the digital control circuitry and the backup digital control circuitry and the controllable component of the engine;
- analog controls mechanically coupled to the analog control circuitry to enable mechanical modulation of the engine;
- and
- a battery electrically coupled to the analog control circuitry, wherein the analog control circuitry is configured to draw, in response to the protection component disabling communication between the digital control circuitry and the controllable component of the engine, power from the battery, and not draw power from power electronics that power the digital control circuitry.
9 more elements
A method comprising:
- controlling, with digital engine controller circuitry of a system, a controllable component of an engine of the system to control the engine of the system;
- sending, by a protection component, a disable signal to an isolation component that is not susceptible to cyberattacks when inputs to the digital engine controller circuitry are inconsistent with previous inputs to the digital engine controller circuitry;
- sending, by the protection component, the disable signal to the isolation component when outputs from the digital engine controller circuitry are determined to be inconsistent with previous outputs from the digital engine controller circuitry;
- ceasing controlling, responsive to receiving the disable signal via the isolation component, the controllable component of the engine with the digital engine controller circuitry, wherein ceasing controlling the controllable component includes disabling an electrical interface between power electronics coupled to the engine and a battery that powers analog engine controller circuitry;
- and
- responsive to ceasing controlling the controllable component of the engine with the digital engine controller circuitry, controlling, with the analog engine controller circuitry of the system, the controllable component of the engine to control the engine, wherein controlling, with the analog engine controller circuitry, the controllable component of the engine comprises drawing, with the analog engine controller circuitry and responsive to ceasing controlling the controllable component of the engine with the digital engine controller circuitry, power from the battery and not the power electronics, wherein analog controls are mechanically coupled to the analog control circuitry to enable mechanical modulation of the engine.
3 more elements
A system comprising:
- means for controlling, with a digital engine controller, a controllable component of an engine to control the engine;
- means for sending a disable signal to an isolation component that is not susceptible to cyberattacks when inputs to the digital engine controller are inconsistent with previous inputs to the digital engine controller;
- means for sending the disable signal to the isolation component when outputs from the digital engine controller are determined to be inconsistent with previous outputs from the digital engine controller;
- means for ceasing controlling, responsive to receiving the disable signal received via the isolation component, the controllable component of the engine with the digital engine controller;
- and
- means for, responsive to ceasing controlling the controllable component of the engine with the digital engine controller, controlling, with an analog engine controller, the controllable component of the engine to control the engine,
- wherein the analog engine controller comprises means for drawing, responsive to ceasing controlling the controllable component of the engine with the digital engine controller, power from a battery that is electrically isolated from power electronics used to power the digital engine controller, wherein analog controls are mechanically coupled to the analog control circuitry to enable mechanical modulation of the engine.
4 more elements
Dependencies are inferred from the claim text.